Partial Fix for #850, breaks upgrade from 0.6

- Check the user's login/password before checking the
force_password_reset value
- For upgrades from 0.6 to work, we need a method to authenticate 0.6
passwords and we need the information to authenticate them (the hash and
salt), neither of which are currently present after upgrading to 0.7